WORLD INTELLECTUAL PROPERTY ORGAKTZATTON 
International Bureau 



PCX 

INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) 


(51) International Patent ClassIQcation ^ : 


(U) International Publication Number: 

WO 99/21142 

G08B 13A2 

Al 

(43) International Publication Date: 




29 April 1999 (29.04.99) 


(21) International Application Number: PCrr/GB9a/0312S 

(22) International Filing Date: 19 October 1998 (19.10.98) 


(30) Priority Data: 
9721932.3 


17 October 1997 (17.10.97) GB 


(71) Applicant (for all designated States except US): W. L. GORE 

& ASSOCIATES (UK) LIMITED [GB/GBJ; 1 Bel! Yard, 
London WOA 2JP (GB). 

(72) Inventor; and 

(75) Inventor/Applicant (for US only); HUNTER, Stephen, BainI 
[GB/GB]; 12 Gamekeepers Road. Kinnesswood. Kinross 
KY13 9JR (GB). 


(81) Designated States: AL, AM, AT. AU. AZ, BA. BB, BG, BR. 
BY, CA. CH, CN, CU, (3, DE, DK, EE, ES. FI, GB. GO, 
GE, GH, GM, HR. HU. ID. IL. IS. JP. KE. KG, KP, KR, 
KZ. LC. LK, LR, LS. LT, LU, LV, MD, MG, MK. MN. 
MW, MX, NO. NZ, PL. PT, RO, RU. SD. SE, SG. SI, SK, 
SL. TJ, TM. TR, TT, UA. UG. US. UZ. VN. YU. ZW, 
ARIPO patent (GH, GM, KE, LS. MW, SD, SZ, UG, ZW), 
Eurasian patent (AM, AZ. BY, KG. KZ. MD. RU. TJ, TM). 
European patent (AT, BE. CH, CY, DE, DK, ES, FI, FR. 
GB, GR, IE. IT, LU, MC, NL, PT. SE). OAPI patent (BF. 
BJ. CF. CG, CI, CM, GA. GN. GW. ML. MR. NE, SN. 
TD, TG). 


Published 

With international search report. 


(74) Agents: McCALLUM. William. Potter et al.; Cruikshank & 
Fainveathcr, 19 Royal Exchange Square. Glasgow Gl 3AE 
(GB). 


(54) TiUe: TAMPER RESPONDENT ENCLOSURE 


(57) Abstract 


A tamper respondent enclosure (10) comprises a wall including at least two layers (34, 35; 34. 24). A first layer of the wall (34) 
comprises a sheet of insulating material (36) having lines of conductive material (38, 39) on first and second sides thereof, the lines forming 
part of a sensor circuit. A detector (16) is provided part of a sensor circuit. A detector (16) is provided for detecting an interruption in 
the circuit. A second layer of the wall (35; 24) comprises an area of conductive material (40, 41; 24) separated from the lines (38. 39) by 
insulating material. The detector (16) will also detect an electrical connection between the lines and the conductive area. The layers of the 
wall are arranged such that, at any point in the wall, the wall section includes at least one of Uie lines and the conductive area. 
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TAMPER RESPONDENT ENCLOStTRE 

This invention relates to a tamper respondent 
enclosure . 

A tamper respondent enclosure may be used in the 
transport and storage of sensitive information, including 
information which is stored electronically. A tamper 
respondent enclosure includes means which, on detection of 
an attempt to penetrate the enclosure, initiates an 
appropriate response, for example activation of an alarm, 
or destruction or erasure of the sensitive material 
contained within the enclosure. Typically, a camper 
respondent enclosure features a wall including appropriate 
penetration detection circuitry. Examples of tamper 
respondent enclosures, and laminates suitable for forming 
the walls of tamper respondent enclosures are described in 
our earlier patent application Nos . GB 2220513 A, 03 
2258075 A, GB 2256956 A, GB 2256957 A, GB 2256958 A, GB 
2270785 A, GB 2275914 A, and GB 2292709 A, the disclosures 
of which are incorporated herein by reference. The 
enclosures disclosed in these documents are typically in 
the form of envelopes or shallow boxes, the walls of which 
are formed by folding flexible sheets incorporating tamper 
respondent features around the subject to be protected, to 
leave no direct opening through which penetration may be 
accomplished. 

The flexible sheets may include tracks or lines of 
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conductive material forming part of one or more sensor 
circuits; an attempt to penetrate the enclosure resulting 
in damage to one or more of the lines creates a detectable 
change in the electrical state of the lines. However, 
drills having a diameter of as little as 0.05 mm are 
available, and using such a drill it may be possible to 
drill a hole through a tamper respondent sheet without 
breaking one of the monitored lines. Accordingly, it is 
conceivable that a small diameter hole could be drilled 
through a tamper respondent sheet and the penetration of 
the sheet remain undetected. 

It is among the objectives of embodiments of the 
present invention to obviate or mitigate this disadvantage. 

According to the present invention there is provided 
a tamper respondent enclosure comprising: a wall including 
at least two layers; at least a first layer of the wall 
comprising a sheet of insulating material having lines of 
conductive material on first and second sides thereof, said 
lines forming part of at least one sensor circuit; means 
for detecting an interruption in said at least one circuit; 
a second layer of the wall comprising an area of conductive 
material separated from said lines by insulating material; 
and means for detecting an electrical connection between at 
least one of said lines and said area, the layers being 
arranged such that, at any point in the wall, the wall 
section includes at least one of said lines and said area. 

The invention is useful in detecting attempted 
penetration of the wall of the enclosure using metal drills 
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which are small enough to penetrate an individual line 
without cutting the line, and thus will not create an 
interruption in the sensor circuit. However, if a drill 
passes through one of the lines, the drill will create a 
detectable electrical connection on contacting the area of 
conductive material. In one embodiment, at least one of 
the lines and the area is formed of a low melt material 
which is fluidised by the heat created by a drilling 
operation, such that the fluidised material will flow 
through the drilled hole and create an electrical 
connection between the line and the area; of course this 
arrangement would also detect penetration by a small 
diameter drill of non- conductive material. 

Preferably, the area of conductive material of the 
second layer is provided by a conductive enclosure, most 
preferably a metal enclosure. The enclosure may be 
provided internally or externally of the layer including 
the lines of conductive material. The enclosure may be 
rigid or may be formed of a flexible material. 

The area of conductive material of the second layer 
may be earthed. 

In an alternative embodiment the area of conductive 
material of the second layer may be provided by lines of 
conductive material of a layer comprising a sheet of 
insulating material with lines of conductive material on 
first and second sides thereof. Said lines may form part 
of a sensor circuit and be provided in combination with 
means for detecting an interruption in said circuit. The 
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sensor circuit may form part of the sensor circuit for the 
first layer or may be operate independently thereof. 
Similarly, the detection means may be common to the first 
and second layers or separate detection means may be 
provided for each layer. The first and second layers may 
be of similar form. 

Preferably also, the lines of conductive material on 
the first and second sides of the first layer are arranged 
such that at any point in the layer a layer section 
includes at least one of said lines. Most preferably, the 
lines are non-rectilinear. 

Preferably also, the insulating material tends to be 
disrupted by drilling, for example the material may 
incorporate fibres, or may bind to a drill, or may fracture 
on contact with a drill or the like. 

According to a further aspect of the present invention 
there is provided a method of forming a tamper respondent 
enclosure, the method comprising the steps: 

providing at least a first layer comprising a sheet of 
insulating material having lines of conductive material on 
first and second sides thereof; 

connecting said lines to at least one sensor circuit 
including means for detecting an interruption in said at 
least one circuit; 

providing a second layer comprising an area of 
conductive material; 

providing means for detecting an electrical connection 
between at least one of said lines and said area; and 
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arranging the layers to define a wall of an enclosure 
such that, at any point in the wall, the wall thickness 
includes at least one of said lines and said area, 

According to a still further aspect of the present 
invention there is provided a tamper respondent enclosure 
comprising: a first enclosure portion having a wall 
including a layer of insulating material carrying lines of 
conductive material thereon, said lines forming part of at 
least one sensor circuit; means for detecting an 
interruption in said at least one circuit; a metal second 
enclosure portion; and means for detecting an electrical 
connection between at least one of said lines and said 
second enclosure portion. 

According to another aspect of the present invention 
there is provided a tamper respondent enclosure comprising 
an insulated conductive enclosure portion; and means for 
detecting an change in an electrical characteristic of said 
enclosure portion. 

In this aspect of the invention a reference voltage 
may be applied to the enclosure portion and on the 
enclosure portion being contacted by an earthed metal drill 
or other electrically conductive object there will be a 
detectable change in the monitored reference voltage. In 
another embodiment, the capacitance of the enclosure 
portion may be monitored, by application of an AC reference 
potential, and there will be a detectable change in the 
monitored capacitance of the enclosure portion if another 
conductive object is brought into contact with the 
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enclosure portion. 

These and other aspects of the present invention will 
now be described, by way of example, with reference to the 
accompanying drawings, in which: 

Figure 1 is a perspective cut-away view of a tamper 
respondent enclosure in accordance with an embodiment of 
the present invention; 

Figure 2 is a greatly enlarged schematic cross - 
sectional view of a portion of the wall of the enclosure of 
Figure 1; 

Figure 3 is a plan view of the wall portion of Figure 

2; 

Figure 4 corresponds to Figure 2, and shows a small 
diameter drill penetrating part of the wall; 

Figure 5 is a schematic illustration of elements of 
the enclosure of Figure 1; 

Figure 6 is a greatly enlarged schematic cross - 
sectional view of a portion of a wall of an enclosure in 
accordance with a further embodiment of the present 
invention; and 

Figure 7 is a circuit diagram representing the wall 
portions of Figure 6. 

Reference is first made to Figure 1 of the drawings, 
which illustrates a tamper^ respondent enclosure in 
accordance with a preferred embodiment of the present 
invention. The enclosure 10 carries security sensitive 
information in an encryption module 12, access to the 
module 12 requiring use of a variable key, the nature of 
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the key being retained in a memory 14. As will be 
described, the enclosure is arranged to detect attempts to 
tamper with or penetrate the enclosure and accordingly 
contains an enclosure monitor 16 which, if tampering is 
detected, activates an erase circuit 18 to erase the 
information stored in the memory 14 and encryption module 
12 . These components are mounted on and interconnected by 
a printed circuit board (PCB) 20, and are powered by a 
single battery 22. 

The walls of the enclosure comprise three primary 
components: an inner metal enclosure portion 24; an 
intermediate enclosure portion 26 in form of a folded 
tamper respondent laminate 32; and an outer enclosure 
portion in the form of a moulding 28, As will be 
described, the tamper respondent laminate 32 includes 
various detection layers which are monitored, via ribbon 
cable 30, by the enclosure monitor 16. The metal enclosure 
portion 24 provides physical protection against violent 
attempts to penetrate the enclosure 10 and disengage the 
enclosure monitor 16 or erase circuit 18 before information 
can be erased from the encryption module 12. The enclosure 
portion 24 also operates in conjunction with the laminate 
32 to detect attempts to penetrate the enclosure using 
small diameter metal drills, as will be described. 

The tamper respondent laminate 32 may take a variety 
of forms, as described in the above -identified patent 
applications. In this embodiment, the laminate 32 includes 
two primary layers 34, 35, as illustrated schematically in 
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Figure 2 of the drawings. Each layer 34 comprises a thin 
insulating film 36, 37 carrying conductive tracks 38, 39, 
40, 41 on the first and second sides thereof. The tracks 
3 8 - 41 form a number of continuous conductors which will 
be broken if attempts are made to penetrate the films 36, 
37. The tracks 38 - 41 are connected to the monitor 16, 
which continually monitors the electrical condition of the 
tracks . 

The tracks 38 - 41 may be arranged in any suitable 
pattern, and Figure 3 of the drawings illustrates non- 
rectilinear "saw tooth" tracks 38 on the upper face of the 
film 36. The tracks 38 are formed of semi -conductive ink 
which has been printed onto the film 36. The tracks 39 on 
the opposite side of the film 36 are the same pattern but 
are offset to lie directly below the spaces 42 between the 
tracks 38; the tracks 38, 3 9 are of a width and pitch, for 
example 250 .and 500 microns, such that piercing of the film 
3 6 at any point results in damage to at least one of the 
tracks 38, 39. 

The films 36, 37 are adhered to one another by 
adhesive (not shown) and are adhered to and folded around 
the metal enclosure portion 24 (adhesive not shown) , in a 
similar manner to gift wrapping a parcel. The film-wrapped 
metal enclosure portion 24 is located within a mould which 
is filled with cold pour thermosetting resin. The resin is 
cured and hardened to form the outer enclosure portion 28. 

The PCB 20 carrying the encryption module 12, memory 
14, monitor 16, erase circuit 18 and battery 22 are located 
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within the metal enclosure portion 24, and the metal 
enclosure portion 24 is earthed to the PCB 20, as 
illustrated at 44 in Figure 5 of the drawings. 

If an attempt is made to penetrate the enclosure 10 
5 using a small diameter metal drill 46 (see Figure 4), the 

drill 46 may pass relatively easily through the moulding 28 
and the intermediate enclosure portion 26, before 
encountering the metal enclosure portion 24, and such a 
partial penetration of the enclosure 10 is illustrated in 

10 Figure 4 of the drawings. If the drill 46 is of 

sufficiently small diameter, it is possible that the drill 
may pass through one or more tracks 3 8 - 41 without 
interrupting the conductive path through the tracks. 
However, if, as illustrated in Figure 4, the drill 46 

15 passes through two tracks 38, 40, the metal drill 46 will 

form an electrical connection between the tracks 38, 40, 
which connection will result in a detectable change in an 
electrical characteristic of the conductors of which the 
tracks 38, 40 form a part. Further, even if the drill 48 

20 only passed through one of the tracks 38, on the drill 46 

contacting the metal enclosure portion 24, the track would 
be earthed to the PCB 20, the drill 46, the enclosure 

portion 24 and the earth connection 44, again providing a 
detectable change in one or more electrical characteristics 

25 of the circuit of which the track 38 forms a part. 

In addition, the tracks 38 - 41 are formed of a low 
melt material, that is conductive ink which will melt at 
the elevated temperatures created by the action of the 
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drill 46 passing through the intermediate enclosure portion 
26. Thus, the conductive material which forms the tracks 
38, 40 through which the drill 46 passes will be fluidised, 
and will flow through the holes 48, 4 9 created in the films 
36, 37 by the drill 46; the fluidised material will 
provide a detectable electrical connection between the 
tracks 38, 40 and also between the tracks 38, 4 0 and the 
metal enclosure portion 24 . 

Reference is now made to Figure 6 of the drawings, 
which illustrates part of the wall 60 of an enclosure in 
accordance with another embodiment of the present 
invention. The wall 60 incorporates a tamper respondent 
laminate 32 as described above. However, located inwardly 
of the laminate 32 is a further laminate 62, as described 
below. 

The laminate 62 comprises a very thin insulating film 
63 of PET, PVC, polypropylene or PEN coated on each side 
with a layer of semi-conductive ink 64, 66, The ink is a 
low melt composition such that the ink will melt and flow 
when drilled. Further, the ink is printed relatively 
thickly to the same thickness as the film 62. 

The elements of the laminates 32, 62 are connected to 
form a sensor circuit 68 as illustrated in Figure 7 of the 
drawings. The tracks are arranged to define conductors 70, 
71, 72, 73 and are arranged as a balanced bridge circuit 
with reference voltages being applied at appropriate points 
in the circuit. The ink layers 64, 66 are illustrated as 
a normally open switch element. 
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Passage of a metal drill through the laminate 62 will 
create an electrical connection between the layer 64, 66, 
which will create a significant and detectable electrical 
imbalance in the circuit 68, detectable by the monitor 16. 
Of course, the drill may also disrupt one or more of the 
tracks 38 - 41, which disruption will also be detected. 

From the above-description it will be apparent to 
those of skill in the art that the enclosures described 
above are secure against penetration attempts using small 
diameter drills, and other small diameter probes. It will 
further be clear to those of skill in the art that the 
above-described embodiments are merely exemplary of the 
present invention, and that various modifications . and 
improvements may be made to the enclosures without 
departing from the scope of the invention. In particular, 
an enclosure in accordance with the invention may 
incorporate one or more of the many tamper respondent 
features described in the above -described patent 
applications. Further, in other embodiments, only a single 
tamper respondent layer 34, 35 may be provided in 
combination with the metal enclosure portion. 
Alternatively, an enclosure wall of an embodiment of the 
invention may consist of a normally insulated metal 
enclosure or a conductive ink laminate which is monitored 
to detect a conductive object, such as a metal drill or 
probe, contacting the enclosure or laminate and changing an 
electrical characteristic thereof. 
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1. A tamper respondent enclosure comprising: 
a wall including at least two layers; 

at least a first layer of the wall comprising a sheet 
5 of insulating material having lines of conductive material 

on first and second sides thereof, said lines forming part 

of at least one sensor circuits- 
means for detecting an interruption- in said at least 

one circuit; 

10 a second layer of the wall comprising an area of 

conduct ive material separated from said lines by insulating 
material; and 

means for detecting an electrical connection between 
at least one of said lines and said area, 
15 the layers of the wall being arranged such that, at 

any point in the wall, the wall section includes at least 
one of said lines and said area. 

2. The enclosure of claim 1, wherein at least one of the 
layers of the wall is flexible. 

20 3. The enclosure of claim 3, wherein at least one of the 

layers of the wall is formed of a folded sheet. 

4. The enclosure of claim 1, 2 or 3, wherein at least one 
of the lines or the area is formed of a low melt material 
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which is fluidised by the heat created by a drilling 
operation, such that the fluidised material will flow 
through the drilled hole and create an electrical 
connection between the line and the area. 

5 5. The enclosure of any of claims 1 to 4, wherein the 

area of conductive material of the second layer comprises 
a conductive enclosure portion. 

6. The enclosure of any of claims 1 to 5, wherein the 
area of conductive material of the second layer is of 

10 metal. 

7. The enclosure of any of the preceding claims wherein 
the area of conductive material of the second layer is 
provided by a rigid enclosure portion. 

8. The enclosure of any of the claims 1 to G, wherein the 
15 area of conductive material of the second layer is of a 

flexible material. 

9. The enclosure of any of the preceding claims wherein 
the second layer of the wall is provided internally of the 
first layer. 

20 10. The enclosure of any of the preceding claims wherein 
the second layer of the wall is provided externally of the 
first layer. 
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11. The enclosure of any of the preceding claims wherein 
the area of conductive material of the second layer is 
earthed. 

12. The enclosure of claim 1, 2 or 3, wherein the area of 
conductive material of the second layer is provided by 
lines of conductive material and said second layer 
comprises a sheet of insulating material with lines of 
conductive material on first and second sides thereof, said 
lines forming part of a sensor circuit and being provided 
in combination with means for detecting an interruption in 
said circuit. 

13. The enclosure of claim 12, wherein the sensor circuit 
of the second layer forms part of the sensor circuit for 
the first layer. 

14. The enclosure of claim 12 or 13, wherein the detection 
means of the second layer also serves as the detection 
means for the first layer. 

15. The enclosure of any of claims 1, 2, 3, 12, 13 or 14, 
wherein the first and second layers are of similar form. 

16. The enclosure of any of the preceding claims wherein 
the lines of conductive material on the first and second 
sides of the first layer are arranged such that at any 
point in the layer a layer section includes at least one of 
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17. The enclosure of any of the preceding claims, wherein 
the lines of conductive material on the first and second 
sides of the first layer are non-rectilinear, 

5 18. A method of forming a tamper respondent enclosure, the 

method comprising the steps: 

providing at least a first layer comprising a sheet of 

insulating material having lines of conductive material on 

first and second sides thereof; 
0 connecting said lines to at least one sensor circuit 

including means for detecting an interruption in said at 

least one circuit; 

providing a second layer comprising an area of 

conductive material; 
5 providing means for detecting an electrical connection 

between at least one of said lines and said area; and 

arranging the layers to define a wall of an enclosure 

such that, at any point in the wall, the wall thickness 

includes at least one of said lines and said area. 

D 19. The method of claim 18, wherein at least one of the 

layers is flexible and is folded to define an enclosure. 

20. A tamper respondent enclosure comprising: 

a first enclosure portion having a wall including. a 
layer of insulating material carrying lines of conductive 
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material thereon, said lines forming part of at least one 
sensor circuit; 

means for detecting an interruption in said at least 
one circuit; 

a metal second enclosure portion; and 

means for detecting an electrical connection between 
at least one of said lines and said second enclosure 
portion. 

21. The enclosure of claim 20, wherein the first enclosure 
portion is defined by a folded flexible sheet. 

22. The enclosure of claim 20 or 21, wherein the lines are 
formed of a low melt material which is fluidised by the 
heat created by a drilling operation, such that the 
fluidised material will flow through the drilled hole and 
create an electrical connection between the lines and the 
area. 

23. A tamper respondent enclosure comprising an insulated 
conductive enclosure portion and means for detecting a 
change in an electrical characteristic of said enclosure 
portion resulting from a conducting object coming into 
electrical contact with the enclosure portion. 

24. A method of protecting an enclosure against attempted 
penetration by a conductive object, the method comprising 
the steps of: providing an insulated conductive enclosure 
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portion; monitoring an electrical characteristic of said 
enclosure portion; and activating penetration response 
means in response to a change in said electrical 
characteristic resulting from a conductive object coming 
into electrical contact with the enclosure portion. 
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